refactor: replace the auth library with custom bearer authentication implementation

sakethpathike · sakethpathike · commit 09e60974b133 · 2025-06-16T17:14:30.000+05:30
- i should have just used `authHeader` and it probably would've fixed the special characters in token = 401 issue
- but this does pretty much the same thing and I learnt a couple of new things so hell yeahh
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -29,7 +29,6 @@ repositories {
 
 dependencies {
     implementation("io.ktor:ktor-server-core-jvm")
-    implementation("io.ktor:ktor-server-auth-jvm")
     implementation("io.ktor:ktor-server-content-negotiation-jvm")
     implementation("io.ktor:ktor-serialization-kotlinx-json-jvm")
     implementation("io.ktor:ktor-server-netty-jvm")
diff --git a/src/main/kotlin/com/sakethh/linkora/Application.kt b/src/main/kotlin/com/sakethh/linkora/Application.kt
@@ -12,7 +12,6 @@ import com.sakethh.linkora.utils.useSysEnvValues
 import io.ktor.server.application.*
 import io.ktor.server.engine.*
 import io.ktor.server.netty.*
-import io.ktor.server.routing.*
 import io.ktor.server.websocket.*
 import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
@@ -121,7 +120,6 @@ object ServerConfiguration {
 fun Application.module() {
     println("The server version is ${Constants.SERVER_VERSION}")
     configureDatabase()
-    configureSecurity()
     configureSerialization()
     val mdManagerRepo : MarkdownManagerRepo = MarkdownManagerRepoImpl()
     val serverConfig =ServerConfiguration.readConfig()
diff --git a/src/main/kotlin/com/sakethh/linkora/Security.kt b/src/main/kotlin/com/sakethh/linkora/Security.kt
@@ -1,22 +1,81 @@
 package com.sakethh.linkora
 
+import io.ktor.http.*
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
+import io.ktor.server.request.path
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+
+val CustomBearerAuth = createRouteScopedPlugin(name = "CustomBearerAuth") {
+    onCall { call ->
+        val rawHeader = call.request.headers[HttpHeaders.Authorization]
+        when {
+            rawHeader == null -> {
+                call.respond(status = HttpStatusCode.Unauthorized, message = "Missing Authorization header")
+            }
+
+            rawHeader.startsWith("Bearer ", ignoreCase = true).not() -> {
+                call.respond(
+                    status = HttpStatusCode.Unauthorized,
+                    message = "Invalid Authorization header format. Expected 'Bearer <token>'."
+                )
+            }
+
+            else -> {
+                val authToken = rawHeader.substringAfter("Bearer").trim()
+                when {
+                    authToken.isBlank() -> {
+                        println("[Auth] Empty token @${call.request.path()}")
+                        call.respond(status = HttpStatusCode.Unauthorized, message = "Bearer token is missing.")
+                    }
+
+                    authToken != ServerConfiguration.readConfig().serverAuthToken.trim() -> {
+                        println("[Auth] Invalid token: \"$authToken\" @${call.request.path()}")
+                        call.respond(status = HttpStatusCode.Unauthorized, message = "Invalid token.")
+                    }
+
+                    authToken == ServerConfiguration.readConfig().serverAuthToken.trim() -> {
+                        println("[Auth] Authenticated @${call.request.path()}")
+                    }
 
-fun Application.configureSecurity() {
-    install(Authentication) {
-        bearer(name = Security.BEARER.name) {
-            authenticate { authToken ->
-                if (authToken.token == ServerConfiguration.readConfig().serverAuthToken) {
-                    UserIdPrincipal(name = "admin")
-                } else {
-                    null
                 }
             }
         }
     }
 }
 
-enum class Security {
-    BEARER
+class AuthenticationRouteSelector() : RouteSelector() {
+    override suspend fun evaluate(context: RoutingResolveContext, segmentIndex: Int): RouteSelectorEvaluation {
+        return RouteSelectorEvaluation.Transparent
+    }
 }
+
+fun Route.authenticate(initOnSuccess: Route.() -> Unit) {
+    val authenticatedRoute = createChild(selector = AuthenticationRouteSelector())
+    authenticatedRoute.install(CustomBearerAuth)
+    authenticatedRoute.initOnSuccess()
+}
+
+/*
+with the auth lib, something like this would have worked:
+
+install(Authentication) {
+        bearer(name = Security.BEARER.name) {
+
+            // `getAuthHeader` uses `call.request.parseAuthorizationHeader()` by default,
+            // we gotta change this
+            // to make sure our parsing is the one that's used and not `parseAuthorizationHeader`,
+            // which doesn't parse as expected if the token contains any special characters
+            authHeader { call ->
+                val rawAuthHeader = call.request.headers[HttpHeaders.Authorization] ?: return@authHeader null
+                if (!rawAuthHeader.startsWith(prefix = "Bearer ", ignoreCase = true)) return@authHeader null
+
+                HttpAuthHeader.Parameterized(
+                    authScheme = "Bearer", parameters = listOf(
+                        HeaderValueParam(
+                            name = "authToken", value = rawAuthHeader.substringAfter("Bearer").trim()
+                        )
+                    )
+                )
+            }
+* */
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/Routing.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/Routing.kt
@@ -1,7 +1,7 @@
 package com.sakethh.linkora.presentation.routing
 
 import com.sakethh.linkora.Constants
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.data.repository.*
 import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.model.ServerConfig
@@ -11,15 +11,14 @@ import com.sakethh.linkora.utils.SysEnvKey
 import com.sakethh.linkora.utils.useSysEnvValues
 import io.ktor.http.*
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.response.*
 import io.ktor.server.routing.*
 import org.jetbrains.exposed.sql.Database
 import java.net.InetAddress
 
 fun Application.configureRouting(serverConfig: ServerConfig, markdownManagerRepo: MarkdownManagerRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             get("/") {
                 call.respond(message = HttpStatusCode.OK, status = HttpStatusCode.OK)
             }
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/FoldersRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/FoldersRouting.kt
@@ -1,19 +1,18 @@
 package com.sakethh.linkora.presentation.routing.http
 
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.dto.IDBasedDTO
 import com.sakethh.linkora.domain.dto.MoveItemsDTO
 import com.sakethh.linkora.domain.dto.folder.*
 import com.sakethh.linkora.domain.repository.FoldersRepo
 import com.sakethh.linkora.utils.respondWithResult
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.routing.*
 
 fun Application.foldersRouting(foldersRepo: FoldersRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             post<AddFolderDTO>(Route.Folder.CREATE_FOLDER.name) { folderDTO ->
                 respondWithResult(foldersRepo.createFolder(folderDTO))
             }
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/LinksRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/LinksRouting.kt
@@ -1,18 +1,17 @@
 package com.sakethh.linkora.presentation.routing.http
 
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.dto.IDBasedDTO
 import com.sakethh.linkora.domain.dto.link.*
 import com.sakethh.linkora.domain.repository.LinksRepo
 import com.sakethh.linkora.utils.respondWithResult
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.routing.*
 
 fun Application.linksRouting(linksRepo: LinksRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             post<AddLinkDTO>(Route.Link.CREATE_A_NEW_LINK.name) {
                 respondWithResult(linksRepo.createANewLink(it))
             }
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/MultiActionRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/MultiActionRouting.kt
@@ -1,6 +1,6 @@
 package com.sakethh.linkora.presentation.routing.http
 
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.domain.DeleteMultipleItemsDTO
 import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.dto.ArchiveMultipleItemsDTO
@@ -10,12 +10,11 @@ import com.sakethh.linkora.domain.dto.folder.MarkItemsRegularDTO
 import com.sakethh.linkora.domain.repository.MultiActionRepo
 import com.sakethh.linkora.utils.respondWithResult
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.routing.*
 
 fun Application.multiActionRouting(multiActionRepo: MultiActionRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             post<ArchiveMultipleItemsDTO>(Route.MultiAction.ARCHIVE_MULTIPLE_ITEMS.name) {
                 respondWithResult(multiActionRepo.archiveMultipleItems(it))
             }
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/PanelsRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/PanelsRouting.kt
@@ -1,6 +1,7 @@
 package com.sakethh.linkora.presentation.routing.http
 
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
+import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.dto.IDBasedDTO
 import com.sakethh.linkora.domain.dto.panel.AddANewPanelDTO
 import com.sakethh.linkora.domain.dto.panel.AddANewPanelFolderDTO
@@ -9,13 +10,11 @@ import com.sakethh.linkora.domain.dto.panel.UpdatePanelNameDTO
 import com.sakethh.linkora.domain.repository.PanelsRepo
 import com.sakethh.linkora.utils.respondWithResult
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.routing.*
-import com.sakethh.linkora.domain.Route
 
 fun Application.panelsRouting(panelsRepo: PanelsRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             post<AddANewPanelDTO>(Route.Panel.ADD_A_NEW_PANEL.name) {
                 respondWithResult(panelsRepo.addANewPanel(it))
             }
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/SyncRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/http/SyncRouting.kt
@@ -1,19 +1,18 @@
 package com.sakethh.linkora.presentation.routing.http
 
-import com.sakethh.linkora.Security
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.domain.Route
 import com.sakethh.linkora.domain.dto.DeleteEverythingDTO
 import com.sakethh.linkora.domain.repository.SyncRepo
 import com.sakethh.linkora.utils.respondWithResult
 import io.ktor.http.*
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.response.*
 import io.ktor.server.routing.*
 
 fun Application.syncRouting(syncRepo: SyncRepo) {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             get(Route.Sync.GET_TOMBSTONES.name) {
                 val eventTimestamp = getTimeStampFromParam() ?: return@get
                 try {
diff --git a/src/main/kotlin/com/sakethh/linkora/presentation/routing/websocket/EventsWebSocketRouting.kt b/src/main/kotlin/com/sakethh/linkora/presentation/routing/websocket/EventsWebSocketRouting.kt
@@ -1,19 +1,18 @@
 package com.sakethh.linkora.presentation.routing.websocket
 
+import com.sakethh.linkora.authenticate
 import com.sakethh.linkora.data.socket.manager.EventsWebSocketManager.closeWriteChannel
 import com.sakethh.linkora.data.socket.manager.EventsWebSocketManager.initializeWriteChannel
-import com.sakethh.linkora.Security
 import com.sakethh.linkora.domain.dto.Correlation
 import io.ktor.server.application.*
-import io.ktor.server.auth.*
 import io.ktor.server.routing.*
 import io.ktor.server.websocket.*
 import io.ktor.websocket.*
 import kotlinx.serialization.json.Json
 
 fun Application.configureEventsWebSocket() {
     routing {
-        authenticate(Security.BEARER.name) {
+        authenticate {
             webSocket(path = "/events") {
                 val correlationParam = call.parameters["correlation"]
                 if (correlationParam == null) {
@@ -45,6 +44,7 @@ fun Application.configureEventsWebSocket() {
                     }
                 } catch (e: Exception) {
                     println("WebSocket error for \"${correlation.clientName}\": ${e.message}")
+                    e.printStackTrace()
                 } finally {
                     closeWriteChannel(correlationId)
                     println("WebSocket closed for \"${correlation.clientName}\".")
